Effective Date: 25.05.2026
Controller: icelandcasinoonline.is
Contact: [email protected]
This Privacy Policy governs the collection, processing, storage, sharing, and deletion of personal data by icelandcasinoonline.is ("we," "us," "our"). It applies to all users of our website, mobile platform, and related services. We operate in full compliance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and applicable national data protection legislation. By using our platform, you acknowledge that you have read and understood this policy.
Article 1 — Who We Are and Why This Policy Exists
icelandcasinoonline.is is the data controller responsible for your personal information. This means we determine the purposes and means by which your data is processed. We take that responsibility seriously. This policy exists not as a legal formality but as a transparent account of what happens to your data from the moment you arrive on our platform to the moment we permanently delete it.
Plain summary: We are in charge of your data. This document tells you exactly what we do with it, step by step.
If you have any questions about this policy at any stage, contact our Data Protection Officer directly at [email protected]. We respond to all privacy enquiries within five working days.
Article 2 — Data We Collect at Each Stage of Your Journey
We collect different categories of data depending on how you interact with icelandcasinoonline.is. The table below maps each interaction point to the data categories it generates.
| Interaction Stage | Data Category | Specific Data Points | Legal Basis |
|---|---|---|---|
| Visiting the website | Technical | IP address, browser type, device model, operating system, session duration, pages visited | Legitimate interests |
| Creating an account | Personal identity | Full name, date of birth, email address, username, country of residence | Contract performance |
| Completing KYC verification | Identity documents | Government-issued ID, proof of address, selfie verification image | Legal obligation |
| Making a deposit or withdrawal | Financial | Payment method details, transaction amounts, timestamps, currency, payment provider reference | Contract performance |
| Playing games | Gameplay | Game sessions, bet amounts, win/loss records, session duration, game preferences | Contract performance |
| Receiving marketing | Preference | Communication preferences, opted-in channels, campaign interaction data | Consent |
| Using live support | Communication | Chat transcripts, email correspondence, support ticket content | Legitimate interests |
| Enabling cookies | Behavioural | Click paths, referral source, interaction patterns, personalisation signals | Consent |
Plain summary: We collect only what we need for the specific thing you are doing. Visiting requires less than registering. Registering requires less than verifying your identity. Each stage has a clear legal reason.
Article 3 — How We Process Your Data and Why
Processing means any operation performed on your data — reading it, analysing it, using it to make a decision. icelandcasinoonline.is processes your personal data for the following defined purposes only.
3.1 Service Delivery
We process your personal and financial data to operate your account, process transactions, and deliver the gaming experience you have contracted with us for. Without this processing, we cannot provide the service. The legal basis is the performance of a contract between you and icelandcasinoonline.is.
3.2 Regulatory and Legal Compliance
We are legally required to verify player identities, monitor transactions for suspicious activity, maintain records for anti-money laundering purposes, and enforce responsible gambling obligations. This processing is mandatory. The legal basis is compliance with a legal obligation under applicable gambling and financial regulation.
3.3 Responsible Gambling Monitoring
We analyse gameplay data — session frequency, deposit patterns, loss trajectories — to identify indicators of problematic gambling behaviour. Where indicators arise, we may make proactive contact or apply account controls. This processing protects your fundamental interests and is conducted on the basis of legitimate interests, balanced against your right to privacy.
3.4 Security and Fraud Prevention
Technical and behavioural data is processed to detect unauthorised account access, fraudulent transactions, and platform abuse. This processing is conducted on the basis of legitimate interests in maintaining platform integrity.
3.5 Marketing Communications
Where you have provided explicit consent, we process your preference data to send promotional communications through your selected channels. You may withdraw consent at any time without affecting the lawfulness of prior processing.
3.6 Platform Improvement
Aggregated, anonymised technical and gameplay data is used to improve platform performance, fix errors, and enhance user experience. This data cannot be used to identify individual players.
Plain summary: We use your data to run your account, comply with the law, keep you safe, prevent fraud, and — only with your permission — send you offers. We never process your data for purposes beyond this list.
Article 4 — Storage: Where Your Data Lives and How It Is Protected
4.1 Storage Locations
Your data is stored on servers located within the European Economic Area (EEA). Where any processing partner operates outside the EEA, we ensure that appropriate safeguards are in place — including Standard Contractual Clauses approved by the European Commission — prior to any data transfer.
4.2 Security Measures
icelandcasinoonline.is implements a layered security architecture proportionate to the sensitivity of the data held. Our measures include:
- Encryption in transit: All data transmitted between your device and our platform is protected using TLS 1.2 or higher.
- Encryption at rest: Sensitive personal and financial data is encrypted at the storage level using AES-256 standard encryption.
- Access controls: Personal data is accessible only to staff with a defined operational need. Access is role-based, logged, and audited regularly.
- Payment security: Financial transaction data is handled in compliance with PCI DSS requirements. Full card numbers are never stored on our systems.
- Penetration testing: Our infrastructure undergoes regular independent security assessments to identify and remediate vulnerabilities.
- Incident response: We maintain a documented data breach response protocol. In the event of a breach likely to affect your rights, we will notify the relevant supervisory authority within 72 hours and inform affected individuals without undue delay.
4.3 Retention Periods
We retain your data only as long as necessary for the purpose for which it was collected, or as required by law.
| Data Category | Retention Period | Reason |
|---|---|---|
| Account and identity data | 5 years after account closure | AML and gambling regulatory requirements |
| Financial transaction records | 7 years from transaction date | Tax and financial regulation |
| KYC verification documents | 5 years after account closure | Legal obligation |
| Gameplay records | 3 years from session date | Regulatory audit requirements |
| Support communications | 2 years from resolution | Dispute resolution |
| Marketing preference data | Until consent is withdrawn | Consent-based processing |
| Technical / log data | 12 months from generation | Security and fraud monitoring |
| Cookie data | As specified per cookie type | See Article 6 |
Plain summary: We keep your data for as long as the law requires or our service needs it. The table above tells you exactly how long each type is held. When the period ends, we delete it permanently.
Article 5 — Sharing: Who Else Sees Your Data
icelandcasinoonline.is does not sell your personal data. We do not share it for third-party marketing purposes. We share data only in the following defined circumstances.
5.1 Service Providers (Data Processors)
We engage third-party processors who act strictly on our documented instructions to deliver platform services. Categories include payment processing providers, identity verification services, cloud hosting infrastructure, customer support tooling, and email delivery platforms. All processors are bound by data processing agreements requiring GDPR-compliant handling.
5.2 Regulatory and Law Enforcement Authorities
We are required by law to disclose certain data — including identity and transaction records — to gambling regulators, financial intelligence units, and law enforcement agencies upon lawful request. We cannot withhold data where disclosure is a legal obligation.
5.3 Responsible Gambling Organisations
Where a player has self-excluded or where we are required to share data with multi-operator self-exclusion registers under applicable regulation, data is shared to the minimum extent necessary to fulfil that obligation.
5.4 Business Transfers
In the event of a merger, acquisition, or sale of assets involving icelandcasinoonline.is, personal data may be transferred as part of that transaction. Affected players will be notified in advance and their rights under this policy will be maintained.
Plain summary: Your data goes to companies that help us run the platform, regulators who require it by law, and — if you self-exclude — responsible gambling registers. It is never sold or shared for commercial purposes by third parties.
Article 6 — Cookies: What We Place and Why
icelandcasinoonline.is uses cookies and similar tracking technologies on our platform. The table below describes each category.
| Cookie Type | Purpose | Duration | Consent Required |
|---|---|---|---|
| Strictly necessary | Session management, login authentication, security tokens | Session / up to 24 hours | No — essential for platform function |
| Functional | Language preferences, display settings, remembered choices | Up to 12 months | No — necessary for user experience |
| Analytical | Aggregated usage statistics, error monitoring, performance data | Up to 13 months | Yes |
| Marketing | Personalised offers, retargeting, affiliate attribution | Up to 24 months | Yes |
You may manage your cookie preferences at any time through the Cookie Settings panel accessible in the footer of our platform. Withdrawing consent for non-essential cookies does not affect your ability to use the core platform.
Article 7 — Your Rights Under GDPR
As a data subject under GDPR, you hold the following enforceable rights in relation to your personal data held by icelandcasinoonline.is.
Right of Access (Article 15 GDPR): You may request a copy of all personal data we hold about you, together with information about how it is processed. We will respond within 30 days of a verified request.
Right to Rectification (Article 16 GDPR): If any data we hold about you is inaccurate or incomplete, you have the right to request correction. We will action verified rectification requests within 30 days.
Right to Erasure (Article 17 GDPR): You may request deletion of your personal data where it is no longer necessary for the purpose collected, where you withdraw consent, or where processing is unlawful. Note that certain data cannot be deleted where we hold it under a legal obligation — we will identify any such data when responding to your request.
Right to Restriction (Article 18 GDPR): You may request that we limit processing of your data while a dispute about its accuracy or lawfulness is resolved.
Right to Data Portability (Article 20 GDPR): Where processing is based on consent or contract and carried out by automated means, you may request your data in a structured, machine-readable format for transfer to another controller.
Right to Object (Article 21 GDPR): You may object at any time to processing based on legitimate interests, including profiling. We will cease that processing unless we can demonstrate compelling legitimate grounds that override your interests.
Right to Withdraw Consent: Where processing is based on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing conducted before withdrawal.
Right to Lodge a Complaint: If you believe your data rights have been violated, you have the right to lodge a complaint with your national supervisory authority. You may also pursue judicial remedy against icelandcasinoonline.is directly.
To exercise any of the above rights, submit a written request to [email protected] with sufficient identification to allow us to verify your identity. We will not charge a fee for standard requests.
Article 8 — Changes to This Policy
icelandcasinoonline.is reserves the right to update this Privacy Policy to reflect changes in our practices, technology, legal requirements, or regulatory guidance. When material changes occur, we will notify registered players by email and post an updated version on our platform with a revised effective date. Continued use of the platform following notification constitutes acceptance of the revised policy.
Article 9 — Contact and Supervisory Authority
Data Controller Contact:
icelandcasinoonline.is
[email protected]
All privacy-related correspondence, data subject requests, and complaints should be directed to [email protected]. We are committed to resolving all enquiries constructively and within the timeframes specified by GDPR. Where we are unable to resolve a concern to your satisfaction, you retain the right to escalate to your national data protection supervisory authority without restriction.